The municipality of Differdange lost over €400,000 in the spring of 2026 after falling prey to a classic business email compromise scam. The fraudsters managed to intercept and take control of the email account belonging to the city's partner architecture firm, tricking municipal officials into paying a fake invoice to a criminal-controlled bank account rather than to the legitimate construction company overseeing ongoing works.
The incident was only made public months later, at the end of September, in a report by the newspaper Tageblatt.
Mayor Guy Altmeisch explained that city staff had checked the transaction multiple times before proceeding with payment, but the criminals, having access to the compromised mailbox, were able to respond convincingly to all verification requests from officials. He added that their teams verified the payment repeatedly and uncovered the fraud within two days.
The criminals had full control of their partner's email and were replying to the municipality's security checks.
Altmeisch acknowledged shortcomings in how the incident was communicated to the public, admitting that the municipal board's communication on this matter did not meet the necessary standards and the facts were disclosed too late, with some inaccuracies.
The municipal board confirmed that internal procedures were immediately strengthened following the discovery and that a criminal complaint was filed. Officials also commissioned a detailed reconstruction of events, which was reviewed and validated by the city's financial department.
The resulting timeline was made public on Friday:
In its statement to RTL Infos on Friday evening, Differdange's administration noted that, in hindsight, the board believes the relevant ministry, the town council, and citizens should have been informed sooner. The statement also clarified that the administration did fulfil its legal obligations by promptly notifying both law enforcement authorities and the relevant banks as soon as the fraud was detected.
Although the city admits there are lessons to be learned from the incident, officials emphasised that Differdange was the victim of an organised crime operation. The perpetrators exploited a legitimate service provider’s compromised email account and simultaneously impersonated both the construction company and the architecture firm using authentic communications.
Crucially, when city employees requested an official document and confirmation from the architecture office before authorising the transfer, it was the criminals themselves, controlling the email account, who responded to these requests, further misleading staff and enabling the fraud.
